CVE-2026-9731
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.9. Missing nonce validation in the plugin_settings function allows unauthenticated attackers to update notification text and CSS settings, injecting unsanitized content echoed on the frontend. The attack requires tricking a site administrator into clicking a link.
Risk Assessment
The risk involves potential injection of malicious JavaScript or HTML into the WordPress site, leading to session theft, redirects, or phishing attacks against users.
Recommendation
Immediately update the Wp Js Detect plugin to the latest available version and implement CSRF protection (nonce) in all administrative functions.
Original NVD description (English source)
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the plugin_settings function. This makes it possible for unauthenticated attackers to update the plugin's notification text and CSS settings (wp_non_js_notification_text and wp_non_js_notification_css), injecting arbitrary content that is echoed unescaped on the frontend via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.